The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill documentation provides a pattern for plugins to manage dependencies via npm install during session initialization. This is a standard platform practice for ensuring required libraries are available in the persistent data directory.
[DYNAMIC_EXECUTION]: The skill scaffolds executable scripts and configurations (like hooks and MCP servers) based on user templates. This is the core functionality of the scaffolding tool and follows established best practices.
[COMMAND_EXECUTION]: The skill generates configurations that enable the execution of shell commands through plugin hooks and bin executables, providing a structured way for plugins to interact with the system.
[INDIRECT_PROMPT_INJECTION]: The skill serves as a template engine that ingests user-supplied strings and interpolates them into generated files like SKILL.md and plugin.json. While this presents an attack surface for indirect prompt injection, the skill mitigates risk through a multi-phase guided process with mandatory user confirmation gates at each stage of creation.
Ingestion points: User input captured during the questionnaire phases (e.g., name, description, and skill logic) in phases/01-plugin-identity.md and phases/03-component-details.md.
Boundary markers: The generated content is structured using standard Markdown and JSON formats.
Capability inventory: The skill facilitates the agent's ability to write files and directories to the local filesystem using standard agent tools.
Sanitization: The skill performs basic validation on identifiers (e.g., enforcing kebab-case) and ensures generated manifests adhere to JSON schema requirements.

plugin-creator